Created
October 1, 2018 11:57
-
-
Save kosciak9/37b08913958565ba2d635cc06a63d6d7 to your computer and use it in GitHub Desktop.
shorewall + netplan
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # | |
| # Shorewall - Sample Interfaces File for two-interface configuration. | |
| # Copyright (C) 2006-2017 by the Shorewall Team | |
| # | |
| # This library is free software; you can redistribute it and/or | |
| # modify it under the terms of the GNU Lesser General Public | |
| # License as published by the Free Software Foundation; either | |
| # version 2.1 of the License, or (at your option) any later version. | |
| # | |
| # See the file README.txt for further details. | |
| #------------------------------------------------------------------------------ | |
| # For information about entries in this file, type "man shorewall-interfaces" | |
| ############################################################################### | |
| ?FORMAT 2 | |
| ############################################################################### | |
| #ZONE INTERFACE OPTIONS | |
| net NET_IF dhcp,tcpflags,nosmurfs,routefilter,logmartians,sourceroute=0,physical=enp0s3 | |
| loc LOC_IF dhcp,tcpflags,nosmurfs,routefilter,logmartians,physical=enp0s8 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # | |
| # Shorewall - Sample Policy File for two-interface configuration. | |
| # Copyright (C) 2006-2015 by the Shorewall Team | |
| # | |
| # This library is free software; you can redistribute it and/or | |
| # modify it under the terms of the GNU Lesser General Public | |
| # License as published by the Free Software Foundation; either | |
| # version 2.1 of the License, or (at your option) any later version. | |
| # | |
| # See the file README.txt for further details. | |
| #------------------------------------------------------------------------------ | |
| # For information about entries in this file, type "man shorewall-policy" | |
| ############################################################################### | |
| #SOURCE DEST POLICY LOGLEVEL RATE CONNLIMIT | |
| $FW net ACCEPT | |
| loc net ACCEPT | |
| net all DROP $LOG_LEVEL | |
| # THE FOLOWING POLICY MUST BE LAST | |
| all all REJECT $LOG_LEVEL | |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # | |
| # Shorewall - Sample Rules File for two-interface configuration. | |
| # Copyright (C) 2006-2015 by the Shorewall Team | |
| # | |
| # This library is free software; you can redistribute it and/or | |
| # modify it under the terms of the GNU Lesser General Public | |
| # License as published by the Free Software Foundation; either | |
| # version 2.1 of the License, or (at your option) any later version. | |
| # | |
| # See the file README.txt for further details. | |
| #------------------------------------------------------------------------------ | |
| # For information about entries in this file, type "man shorewall-rules" | |
| ###################################################################################################################################################################################################### | |
| #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER | |
| # PORT PORT(S) DEST LIMIT GROUP | |
| ?SECTION ALL | |
| ?SECTION ESTABLISHED | |
| ?SECTION RELATED | |
| ?SECTION INVALID | |
| ?SECTION UNTRACKED | |
| ?SECTION NEW | |
| # Don't allow connection pickup from the net | |
| # | |
| Invalid(DROP) net all tcp | |
| # | |
| # Accept DNS connections from the firewall to the network | |
| # | |
| DNS(ACCEPT) $FW net | |
| DNS(ACCEPT) loc $FW | |
| # | |
| # Accept SSH connections from the local network for administration | |
| # | |
| SSH(ACCEPT) loc $FW | |
| SSH(ACCEPT) net $FW | |
| # | |
| # Allow Ping from the local network | |
| # | |
| Ping(ACCEPT) loc $FW | |
| Ping(ACCEPT) $FW loc | |
| # | |
| # Drop Ping from the "bad" net zone.. and prevent your log from being flooded.. | |
| # | |
| Ping(DROP) net $FW | |
| ACCEPT $FW loc icmp | |
| ACCEPT $FW net icmp | |
| # |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| ############################################################################### | |
| # | |
| # Shorewall Version 5 -- /etc/shorewall/shorewall.conf | |
| # | |
| # For information about the settings in this file, type "man shorewall.conf" | |
| # | |
| # Manpage also online at http://www.shorewall.net/manpages/shorewall.conf.html | |
| ############################################################################### | |
| # S T A R T U P E N A B L E D | |
| ############################################################################### | |
| STARTUP_ENABLED=Yes | |
| ############################################################################### | |
| # V E R B O S I T Y | |
| ############################################################################### | |
| VERBOSITY=1 | |
| ############################################################################### | |
| # P A G E R | |
| ############################################################################### | |
| PAGER= | |
| ############################################################################### | |
| # F I R E W A L L | |
| ############################################################################### | |
| FIREWALL= | |
| ############################################################################### | |
| # L O G G I N G | |
| ############################################################################### | |
| LOG_LEVEL="info" | |
| BLACKLIST_LOG_LEVEL= | |
| INVALID_LOG_LEVEL= | |
| LOG_BACKEND= | |
| LOG_MARTIANS=Yes | |
| LOG_VERBOSITY=2 | |
| LOGALLNEW= | |
| LOGFILE=/var/log/messages | |
| LOGFORMAT="%s %s " | |
| LOGTAGONLY=No | |
| LOGLIMIT="s:1/sec:10" | |
| MACLIST_LOG_LEVEL="$LOG_LEVEL" | |
| RELATED_LOG_LEVEL= | |
| RPFILTER_LOG_LEVEL="$LOG_LEVEL" | |
| SFILTER_LOG_LEVEL="$LOG_LEVEL" | |
| SMURF_LOG_LEVEL="$LOG_LEVEL" | |
| STARTUP_LOG=/var/log/shorewall-init.log | |
| TCP_FLAGS_LOG_LEVEL="$LOG_LEVEL" | |
| UNTRACKED_LOG_LEVEL= | |
| ############################################################################### | |
| # L O C A T I O N O F F I L E S A N D D I R E C T O R I E S | |
| ############################################################################### | |
| ARPTABLES= | |
| CONFIG_PATH=":${CONFDIR}/shorewall:${SHAREDIR}/shorewall" | |
| GEOIPDIR=/usr/share/xt_geoip/LE | |
| IPTABLES= | |
| IP= | |
| IPSET= | |
| LOCKFILE= | |
| MODULESDIR= | |
| NFACCT= | |
| PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin" | |
| PERL=/usr/bin/perl | |
| RESTOREFILE=restore | |
| SHOREWALL_SHELL=/bin/sh | |
| SUBSYSLOCK="" | |
| TC= | |
| ############################################################################### | |
| # D E F A U L T A C T I O N S / M A C R O S | |
| ############################################################################### | |
| ACCEPT_DEFAULT="none" | |
| BLACKLIST_DEFAULT="Broadcast(DROP),Multicast(DROP),dropNotSyn:$LOG_LEVEL,dropInvalid:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL" | |
| DROP_DEFAULT="Broadcast(DROP),Multicast(DROP)" | |
| NFQUEUE_DEFAULT="none" | |
| QUEUE_DEFAULT="none" | |
| REJECT_DEFAULT="Broadcast(DROP),Multicast(DROP)" | |
| ############################################################################### | |
| # R S H / R C P C O M M A N D S | |
| ############################################################################### | |
| RCP_COMMAND='scp ${files} ${root}@${system}:${destination}' | |
| RSH_COMMAND='ssh ${root}@${system} ${command}' | |
| ############################################################################### | |
| # F I R E W A L L O P T I O N S | |
| ############################################################################### | |
| ACCOUNTING=Yes | |
| ACCOUNTING_TABLE=filter | |
| ADD_IP_ALIASES=No | |
| ADD_SNAT_ALIASES=No | |
| ADMINISABSENTMINDED=Yes | |
| AUTOCOMMENT=Yes | |
| AUTOHELPERS=Yes | |
| AUTOMAKE=Yes | |
| BALANCE_PROVIDERS=No | |
| BASIC_FILTERS=No | |
| BLACKLIST="NEW,INVALID,UNTRACKED" | |
| CLAMPMSS=No | |
| CLEAR_TC=Yes | |
| COMPLETE=No | |
| DEFER_DNS_RESOLUTION=Yes | |
| DELETE_THEN_ADD=Yes | |
| DETECT_DNAT_IPADDRS=No | |
| DISABLE_IPV6=No | |
| DOCKER=No | |
| DONT_LOAD= | |
| DYNAMIC_BLACKLIST=Yes | |
| EXPAND_POLICIES=Yes | |
| EXPORTMODULES=Yes | |
| FASTACCEPT=No | |
| FORWARD_CLEAR_MARK= | |
| HELPERS= | |
| IGNOREUNKNOWNVARIABLES=No | |
| IMPLICIT_CONTINUE=No | |
| INLINE_MATCHES=No | |
| IPSET_WARNINGS=Yes | |
| IP_FORWARDING=Keep | |
| KEEP_RT_TABLES=No | |
| LOAD_HELPERS_ONLY=Yes | |
| MACLIST_TABLE=filter | |
| MACLIST_TTL= | |
| MANGLE_ENABLED=Yes | |
| MAPOLDACTIONS=No | |
| MARK_IN_FORWARD_CHAIN=No | |
| MINIUPNPD=No | |
| MULTICAST=No | |
| MUTEX_TIMEOUT=60 | |
| NULL_ROUTE_RFC1918=No | |
| OPTIMIZE=All | |
| OPTIMIZE_ACCOUNTING=No | |
| PERL_HASH_SEED=0 | |
| REJECT_ACTION= | |
| REQUIRE_INTERFACE=No | |
| RESTART=restart | |
| RESTORE_DEFAULT_ROUTE=Yes | |
| RESTORE_ROUTEMARKS=Yes | |
| RETAIN_ALIASES=No | |
| ROUTE_FILTER=Yes | |
| SAVE_ARPTABLES=No | |
| SAVE_IPSETS=No | |
| TC_ENABLED=Internal | |
| TC_EXPERT=No | |
| TC_PRIOMAP="2 3 3 3 2 3 1 1 2 2 2 2 2 2 2 2" | |
| TRACK_PROVIDERS=Yes | |
| TRACK_RULES=No | |
| USE_DEFAULT_RT=Yes | |
| USE_NFLOG_SIZE=No | |
| USE_PHYSICAL_NAMES=No | |
| USE_RT_NAMES=No | |
| VERBOSE_MESSAGES=Yes | |
| WARNOLDCAPVERSION=Yes | |
| WORKAROUNDS=No | |
| ZERO_MARKS=No | |
| ZONE2ZONE=- | |
| ############################################################################### | |
| # P A C K E T D I S P O S I T I O N | |
| ############################################################################### | |
| BLACKLIST_DISPOSITION=DROP | |
| INVALID_DISPOSITION=CONTINUE | |
| MACLIST_DISPOSITION=REJECT | |
| RELATED_DISPOSITION=ACCEPT | |
| RPFILTER_DISPOSITION=DROP | |
| SMURF_DISPOSITION=DROP | |
| SFILTER_DISPOSITION=DROP | |
| TCP_FLAGS_DISPOSITION=DROP | |
| UNTRACKED_DISPOSITION=CONTINUE | |
| ################################################################################ | |
| # P A C K E T M A R K L A Y O U T | |
| ################################################################################ | |
| TC_BITS= | |
| PROVIDER_BITS= | |
| PROVIDER_OFFSET= | |
| MASK_BITS= | |
| ZONE_BITS=0 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # | |
| # Shorewall - Sample SNAT/Masqueradee File for two-interface configuration. | |
| # Copyright (C) 2006-2017 by the Shorewall Team | |
| # | |
| # This library is free software; you can redistribute it and/or | |
| # modify it under the terms of the GNU Lesser General Public | |
| # License as published by the Free Software Foundation; either | |
| # version 2.1 of the License, or (at your option) any later version. | |
| # | |
| # See the file README.txt for further details. | |
| #------------------------------------------------------------------------------ | |
| # For information about entries in this file, type "man shorewall-snat" | |
| # | |
| # See http://shorewall.net/manpages/shorewall-snat.html for more information | |
| ########################################################################################################################################### | |
| #ACTION SOURCE DEST PROTO PORT IPSEC MARK USER SWITCH ORIGDEST PROBABILITY | |
| # | |
| # Rules generated from masq file /home/teastep/shorewall/trunk/Shorewall/Samples/two-interfaces/masq by Shorewall 5.0.13-RC1 - Sat Oct 15 11:41:40 PDT 2016 | |
| # | |
| MASQUERADE 10.0.0.0/8,\ | |
| 169.254.0.0/16,\ | |
| 172.16.0.0/12,\ | |
| 192.168.0.0/16 NET_IF |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # | |
| # Shorewall - Sample Zones File for two-interface configuration. | |
| # Copyright (C) 2006-2014 by the Shorewall Team | |
| # | |
| # This library is free software; you can redistribute it and/or | |
| # modify it under the terms of the GNU Lesser General Public | |
| # License as published by the Free Software Foundation; either | |
| # version 2.1 of the License, or (at your option) any later version. | |
| # | |
| # See the file README.txt for further details. | |
| #------------------------------------------------------------------------------ | |
| # For information about entries in this file, type "man shorewall-zones" | |
| ############################################################################### | |
| #ZONE TYPE OPTIONS IN OUT | |
| # OPTIONS OPTIONS | |
| fw firewall | |
| net ipv4 | |
| loc ipv4 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment